Skip to content
This repository has been archived by the owner on Nov 6, 2020. It is now read-only.

Content Security Policy #5790

Merged
merged 6 commits into from Jun 28, 2017
Merged

Content Security Policy #5790

merged 6 commits into from Jun 28, 2017

Conversation

tomusdrw
Copy link
Collaborator

@tomusdrw tomusdrw commented Jun 7, 2017

Closes #4315

Also fixes issue on firefox when accessing dapps on http://localhost:8180

@tomusdrw tomusdrw added A0-pleasereview 🤓 Pull request needs code review. M4-core ⛓ Core client code / Rust. labels Jun 7, 2017
@tomusdrw tomusdrw requested review from jacogr and ngotchac June 7, 2017 16:58
@@ -41,7 +41,7 @@ export default class DappIcon extends Component {
src={
app.type === 'local'
? `${dappsUrl}/${app.id}/${app.iconUrl}`
: `${dappsUrl}${app.image}`
: `${app.image}`
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/api/content is now available on :8180 as well, so we don't need to go to :8545.

@gavofyork gavofyork removed the A0-pleasereview 🤓 Pull request needs code review. label Jun 9, 2017
@rphmeier rphmeier added the A0-pleasereview 🤓 Pull request needs code review. label Jun 16, 2017
@arkpar
Copy link
Collaborator

arkpar commented Jun 27, 2017

Is this compatible with all major browsers?

@tomusdrw
Copy link
Collaborator Author

Yup:
screenshot from 2017-06-28 08-23-14

Anyway it's increased security for the browser that support it and it's ignored by the ones that don't. I didn't remove old security headers we used although they are now obsolete (e.g. x-frame-options) for the exact same reasons. The spec says that if both are present CSP will take precedence.

@arkpar arkpar added A8-looksgood 🦄 Pull request is reviewed well. and removed A0-pleasereview 🤓 Pull request needs code review. labels Jun 28, 2017
@arkpar arkpar merged commit c7a043b into master Jun 28, 2017
@arkpar arkpar deleted the x-frame-options branch June 28, 2017 07:12
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
A8-looksgood 🦄 Pull request is reviewed well. M4-core ⛓ Core client code / Rust.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Dapps server should return ContentSecurityPolicy headers
4 participants